Overview

overview

8

Static

static

7

c9424c4b60...18.exe

windows7-x64

8

c9424c4b60...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c9424c4b6057d6c7a6d694762e3c6dd2_JaffaCakes118

  • Size

    121KB

  • Sample

    240829-vr5gzavajp

  • MD5

    c9424c4b6057d6c7a6d694762e3c6dd2

  • SHA1

    9fd549e618d6d726234dad7e66053bf957518708

  • SHA256

    fc70a35fc14bb339d472acdacfe886b8a37c75325a81cf0c4b28326f2b625f3a

  • SHA512

    3f487c85bb2466b135fcb8604d1101cedad8e0f3097c3d96ba03151a0f17d9e9392d27b2be5565b0ef82ec12aac7f3c5f430a995fd945570e5f8f62b75f1de4d

  • SSDEEP

    3072:teSQ41MZrrOwzrq5Ss9eYfphfFQkUcot3EpeBWLs+gozFrQ:tVYrJrOSsRwcplgoz1Q

Score
8/10
discoveryupx

Malware Config

Targets

    • Target

      c9424c4b6057d6c7a6d694762e3c6dd2_JaffaCakes118

    • Size

      121KB

    • MD5

      c9424c4b6057d6c7a6d694762e3c6dd2

    • SHA1

      9fd549e618d6d726234dad7e66053bf957518708

    • SHA256

      fc70a35fc14bb339d472acdacfe886b8a37c75325a81cf0c4b28326f2b625f3a

    • SHA512

      3f487c85bb2466b135fcb8604d1101cedad8e0f3097c3d96ba03151a0f17d9e9392d27b2be5565b0ef82ec12aac7f3c5f430a995fd945570e5f8f62b75f1de4d

    • SSDEEP

      3072:teSQ41MZrrOwzrq5Ss9eYfphfFQkUcot3EpeBWLs+gozFrQ:tVYrJrOSsRwcplgoz1Q

    Score
    8/10
    discoveryupx

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks